> Periodic reminder that these are just passwords too. They should be treated as such by users (generate random responses) and devs (hash and salt them). Unfor

> Periodic reminder that these are just passwords too. They should be treated as such by users (generate random responses) and devs (hash and salt them). Unfortunately this is not how almost any business treats them; they are frequently used as challenge/response authentication over the phone, so using a random response or hashing and salting them doesn't work. Authenticating a user over the phone is a major unsolved problem IMO, and responsible for a huge swath of modern account takeover issues.